4 ms·

Why not not both? Escaping output should be a requirement but doesn't hurt to remove obvious garbage in the input (including harmless stuff like pointless space

Why not not both? Escaping output should be a requirement but doesn't hurt to remove obvious garbage in the input (including harmless stuff like pointless spaces)

sfvisser 2y ago
The article clearly states why not: first you probably screw up your data (example is names, but there are many more examples) and second what is garbage depends on your output usage. Html/sql/JSON/etc all require a different sanitization.
cjfd 2y ago
The article tell us that input validation is okay but argues against input sanitization. I.e., if there is obvious garbage in the input tell the user that the input is wrong and don't store it and also do not try to correct it. That seems good advice in most cases. Your example of point less spaces is good though. I think it is generally a good idea to remove those.
dotancohen 2y ago
Regarding harmless stuff like pointless spaces. I know a person who uses two spaces between his first and last name, because his culture users a second given name yet he has none. So, one space between the first given name and the second (nonexistent) given name, then another space between the second (nonexistent) given name and the family name. You might think it is weird or unnecessary, but that is his identity. One could counter with far weirder or seemingly unnecessary things we accept regarding peoples' identity today.
- WillAdams 2y ago
  Obvious solution is for this person to adopt the "Zero Width Non Joiner" character as their middle name --- that would ensure that this doubled-up-space would be preserved.
  - dotancohen 2y ago
    I hate to belittle a point, but your obvious solution is wrong. For one thing, considering that you know that unicode even exists, then it is likely that you know the difference between NULL and the "Zero Width Non Joiner" character. His second given name is NULL. Secondly, throwing obscure technical solutions to laymens' problems for which they already have a working solution is nearly always a problem in the making.
genocidicbunny 2y ago
How do you define what is and isn't garbage in free-form text input though? You can probably come up with some set of rules that covers all the current exceptions, but at what cost in creating and maintaining such a system?

Why not not both? Escaping output should be a requirement but doesn't hurt to remove obvious garbage in the input (including harmless stuff like pointless spaces)

sfvisser 2y ago

The article clearly states why not: first you probably screw up your data (example is names, but there are many more examples) and second what is garbage depends on your output usage. Html/sql/JSON/etc all require a different sanitization.

cjfd 2y ago

The article tell us that input validation is okay but argues against input sanitization. I.e., if there is obvious garbage in the input tell the user that the input is wrong and don't store it and also do not try to correct it. That seems good advice in most cases. Your example of point less spaces is good though. I think it is generally a good idea to remove those.

dotancohen 2y ago

Regarding harmless stuff like pointless spaces. I know a person who uses two spaces between his first and last name, because his culture users a second given name yet he has none. So, one space between the first given name and the second (nonexistent) given name, then another space between the second (nonexistent) given name and the family name. You might think it is weird or unnecessary, but that is his identity. One could counter with far weirder or seemingly unnecessary things we accept regarding peoples' identity today.

WillAdams 2y ago
Obvious solution is for this person to adopt the "Zero Width Non Joiner" character as their middle name --- that would ensure that this doubled-up-space would be preserved.
- dotancohen 2y ago
  I hate to belittle a point, but your obvious solution is wrong. For one thing, considering that you know that unicode even exists, then it is likely that you know the difference between NULL and the "Zero Width Non Joiner" character. His second given name is NULL. Secondly, throwing obscure technical solutions to laymens' problems for which they already have a working solution is nearly always a problem in the making.

genocidicbunny 2y ago

How do you define what is and isn't garbage in free-form text input though? You can probably come up with some set of rules that covers all the current exceptions, but at what cost in creating and maintaining such a system?